Chapter 7 Sensitive data Flashcards
Which are special categories of data
racial, ethnic origin
political opinion
trade union membership
religious and philosophical beliefs
genetic and biometric data for the purpose of uniquely identifying a natural person
data concerning health
sexual life, orientation
the choice of categories influenced by anti-discrimination laws
Article 9
processing is prohibited
Are photographs automatically considered sensitive (biometric) data?
Only when they are processed through specific technical means that allow the unique identification or authentication of an individual
What options have member states in terms of sensitive data?
They can introduce further conditions, including limitations for the processing of genetic data, biometric data and data concerning health
Data on criminal convictions and offences - Article 10:
- can only be carried out under the control of official authority or
- when P is authorised by Union or Member state law providing for appropriate safeguards for the rights and freedoms of DS
Which is the first convention dealing with SD
Convention 108
What is the reason for special protection of PS?
they are particularly sensitive in relation to FRF and therefore merit specific protection since the context could create significant risks.
Which conditions must C meet when processing SD?
it is prohibited, but there are narrow exceptions
Under Article 6 and 9 GDPR
Under Articles 12-14 - notification
What are the exceptions
explicit consent of DS
employment, social security, social protection law
vital interests
foundation, association, non-for-profit organisation with a political, philosophical, religious or trade union aim
sensitive data are made public by the DS
establishment, exercise or defense of legal claims
reasons of substantial public interest
preventive or occupational medicine, work capacity assessment, medical diagnosis, provision of health or social care or treatment
management of health and social care systems and services
reasons of public interest in the area of public health
archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
SD - Explain explicit consent exclusion
consent must be freely given, specific, informed, unambigous but also EXPLICIT =STATEMENT OR CLEAR AFFIRMATIVE ACTION TO SIGNIFY AGREEMENT; IT REFERS TO THE WAY CONSENT IS EXPRESSED - DS must provide an express statement of consent.
Consent must also state the purposes of the processing
Good idea to include the the actual data or categories of data
Be in writing or documented in some other permanent record
How can an express statement of consent be provided in an online environment?
by filling in an electronic form, sending an email, using electronic signatures, employing 2-stage verification
What are the rights of Member states regarding the explicit consent?
MS Law may stipulate giving consent is not enough to avoid prohibition on processing sensitive data. The C will need to look for another supporting criterion.
Guidance from DPAs will define what is required to meet explicit consent standard; e.g. they must be in writing (difficulties for collecting SD through internet especially if the local law doesn’t accept consent expressed in electronic form as evidence of written consent)
different positions through different jurisdictions
SD - explain “employment, social security, social protection law” exclusion
Processing is necessary for the C to comply with a legal obligation under employment, social security, social protection law, e.g. candidates, employees, contractors
Necessity test!
SD - explain “vital interests” exclusion
situation of life and death
Similar to Article 6 but in this case the C must be able to demonstrate it is not possible to obtain consent because DS is physically or legally incapable of giving it. The C must attempt to obtain consent.
SD - explain “foundation, association, non-for-profit organisation with a political, philosophical, religious or trade union aim” exclusion
relates to nonprofit institutions such as churches, political parties
processing relates to members or ex-members
the C must comply with all other requirements of GDPR and processing can only take place:
- in the course of their legitimate activity
- with appropriate safeguards
- in connection with their specific purposes
They are not allowed to share data outside organisation without DS’s explicit consent
Further requirements can be defined by local law.
SD - explain “sensitive data are made public by the DS” exclusion
DS deliberately discloses SD about themselves (eg.. in an interview)
But the use of this data is not unregulated!
SD - explain “establishment, exercise or defense of legal claims” exclusion
the Necessity test - close connection btw the processing and the purposes
Example: the insurance company processes medical data to determine if DS’s claim for medical insurance is valid
Also - processing is necessary whenever courts are acting in judicial capacity
